Virtual Machine

A physical server has real CPUs, RAM, disks, and network cards. A virtual machine takes a slice of those resources and presents them to a guest operating system as if they were a dedicated physical computer. The guest OS boots, installs drivers, and runs programs without knowing it is sharing the box with other VMs.

The piece of software that creates and manages VMs is called a hypervisor. A Type 1 hypervisor (also called bare metal) runs directly on the hardware, like VMware ESXi, Microsoft Hyper-V, KVM on Linux, or Xen. A Type 2 hypervisor runs as an application inside a host OS, like VirtualBox or VMware Workstation on your laptop. Cloud providers run Type 1 hypervisors because they are faster and more secure for multi-tenant use.

Each VM gets a virtual disk (a file like a .vmdk or .qcow2), a configured amount of RAM, a set of virtual CPU cores, and one or more virtual network interfaces. You can pause a VM, snapshot it, copy it, or move it to another physical host while it keeps running, which is called live migration.

The core job of a hypervisor is to give each guest the illusion of owning the hardware while keeping them apart. When a guest tries to run a privileged instruction, like talking to a disk or reconfiguring memory, the hypervisor intercepts it and handles it safely. Early virtualization did this with slow software trapping and binary translation.

Modern VMs rely on hardware assistance built into CPUs: Intel VT-x and AMD-V add a separate execution mode so guest code runs almost at native speed and the hypervisor only steps in for sensitive operations. Intel EPT and AMD NPT add nested page tables so the CPU translates guest memory addresses to real machine addresses in hardware instead of the hypervisor doing it by hand.

Memory is partitioned so one VM cannot read another VM's RAM. CPU time is scheduled across VMs much like an OS schedules threads. Devices are either fully emulated, paravirtualized with guest-aware drivers like virtio for much better throughput, or passed through directly with SR-IOV and IOMMU for near-native I/O.

Because the whole machine state lives in files and configuration, a VM is portable. You can snapshot its disk and memory, roll back to that exact point after a bad deploy, or clone it a hundred times to build an autoscaling fleet.

Use a VM when you need strong isolation, a full operating system, or a kernel different from the host. A VM can run Windows on a Linux host, run an old kernel a legacy app depends on, or give a hostile tenant a hard security boundary. Each guest has its own kernel, so a crash or compromise inside one VM stays inside it.

The cost is weight. A VM carries an entire OS, so it boots in tens of seconds to minutes, uses gigabytes of RAM and disk before your app even starts, and has a thin but real performance overhead, usually a few percent. Containers, by contrast, share the host kernel, start in milliseconds, and pack far more density on the same hardware.

A common pattern in production is to combine them: run lightweight containers, but place those containers inside VMs so the kernel boundary still protects tenants from each other. Tools like Firecracker and Kata Containers push this further with microVMs that boot in around 125 milliseconds and use only a few megabytes of overhead, getting close to container speed while keeping VM-grade isolation.

When you launch an Amazon EC2 t3.medium instance, AWS is creating a VM for you. Behind the scenes the Nitro hypervisor, a lightweight KVM-based design, carves out 2 vCPUs and 4 GB of RAM from a much larger physical server in a specific Availability Zone and boots your chosen image, say Ubuntu 22.04.

Dozens of other customers' VMs may live on that same physical host, but Nitro keeps them isolated through hardware virtualization and dedicated Nitro cards that offload networking and storage. You can snapshot the root volume to an AMI, launch fifty identical copies behind a load balancer, and resize from t3.medium to t3.large with a stop and start, all because the machine is software-defined rather than physical.